Migrate Dokka to 2.x and preserve javadoc jar publishing

[coderabbitai]

Summary

Migrate the documentation and publishing configuration from Dokka 1.x to Dokka 2.x. This migration removes the remaining vulnerable Dokka dependency surfaces.

Security scope

The current PR leaves 15 advisories that Dokka 2.2.0 should remove:

• 9 advisories on the Dokka Gradle plugin classpath:
  • com.fasterxml.jackson.core:jackson-core:2.12.7
  • com.fasterxml.jackson.core:jackson-databind:2.12.7.1
  • com.fasterxml.woodstox:woodstox-core:6.2.4
• 6 Jackson advisories on project configurations. The current Jackson 2.14.3 pin cannot remove these advisories because Dokka 1.9.20 cannot run on the later Jackson line.

dokka-gradle-plugin 2.2.0 drops Jackson and Woodstox. It closes all 15 advisories across these two dependency surfaces.

Required changes

• Upgrade org.jetbrains.dokka from Dokka 1.x to Dokka 2.x.
• Migrate documentation tasks from the disabled Dokka V1 tasks.
• Update the javadoc-jar wiring used by com.vanniktech.maven.publish 0.31.0. The current configuration depends on dokkaHtml and dokkaJavadoc, but Dokka 2.x disables V1 tasks and has no Javadoc output format.
• Remove the Jackson version pin from gradle/libs.versions.toml.
• Remove the Jackson entries and related compatibility comment from the securityPins block in android/build.gradle.kts.
• Keep the Netty, protobuf, and jsoup pins. They protect unrelated project-configuration dependencies and are not part of the Dokka migration.

Affected areas

• android/build.gradle.kts
• gradle/libs.versions.toml
• Maven publishing and documentation-task configuration

Acceptance criteria

• The resolved Dokka Gradle plugin classpath contains no vulnerable Jackson 2.12.x or Woodstox 6.2.4 dependencies.
• The resolved project configurations contain no Jackson dependencies retained only for Dokka 1.x compatibility.
• publishAndReleaseToMavenCentral produces a populated javadoc jar.
• Documentation and publishing verification covers the Dokka 2.x task model.
• The Netty, protobuf, and jsoup security pins remain in place.

Context

Follow-up from PR #61 and its review thread:

• fix(security): patch known vulnerabilities in the build toolchain #61
• fix(security): patch known vulnerabilities in the build toolchain #61 (comment)

Requested by @mattinannt. The analysis and PR content were generated by Claude Code while operating under this account.